can we define a distribution group having an externally visible email address

Yes.

zero or more members

Yes.

and all incoming email routed into a permission-protected public folder?

The documentation states that Zimbra currently supports shared calendars, contacts and documents, but not shared email folders. However, there appears to be active work being done to implement this in the beta 5.0.0 code. In 4.5.6 you can use zmmailbox to grant access to other people's folders (A folder of a system account could be used as a public folder) but the GUI doesn't appear to support subscribing to them and the IMAP server doesn't expose a 'Shared' namespace.